# What is SSO (single sign-on)?

Source: https://kurumsal.pro/en/glossary/sso/ — Last updated: 2026-11-04

SSO (Single Sign-On) is an authentication method that lets a user sign in once with the company's identity system and reach many applications without entering a separate password. The Kurumsal.pro portal does not offer SSO sign-in; it uses email and password, an authenticator app and a passkey.

## In short
- SSO lets a user sign in once at the company's identity provider and reach many applications.
- In SSO the identity is verified by the company's identity provider, not the application; the application trusts that verification.
- SAML and OpenID Connect (OIDC) are the two most widely used protocols for SSO.
- The Kurumsal.pro portal has no SSO sign-in, no LDAP / Active Directory connection and no directory sync with SCIM.
- Sign-in to the portal uses email and password, two-factor authentication with an authenticator app, and a passkey.

**SSO (single sign-on):** SSO (Single Sign-On) lets a user sign in once at the company's identity provider and reach many applications without separate passwords. The Kurumsal.pro portal has no SSO sign-in.

SSO (Single Sign-On) is an authentication method that lets a user sign in once in the company's identity system and reach many applications without entering a separate password. The Kurumsal.pro portal does not offer SSO sign-in. This entry gives the general definition of the term and states clearly how sign-in to the portal works today.

## How does SSO work?

In SSO, the identity is verified not by the application itself but by the company's identity provider. When a user wants to enter an application, the application redirects them to the identity provider. If the user is already signed in there, or signs in anew, the identity provider sends the application a signed assertion and the application lets the user in.

A typical SSO flow has these steps:

1. The user opens the application's sign-in page.
2. The application redirects the user to the company's identity provider.
3. The identity provider verifies the user (company password, additional verification and so on).
4. The identity provider sends the application a signed response and the application opens the session.

The benefit to the company is that identity is managed in one place: when a user leaves, the account at the identity provider is closed and access to the connected applications is cut off too. For the user, the benefit is fewer passwords to remember. The trade-off is that the identity provider becomes a critical point; an outage or account breach there affects all connected applications.

## What is the difference between SAML and OIDC?

SAML and OpenID Connect (OIDC) are the two most common protocols for SSO; both carry authentication information between the identity provider and the application. [SAML 2.0](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) is an XML-based standard published by OASIS and has long been used in enterprise applications. [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) is an identity layer built on OAuth 2.0; it carries identity information in signed JSON tokens (JWT) and is common in web and mobile applications.

| | SAML | OIDC |
|---|---|---|
| Data format | XML | JSON (JWT) |
| Built on | Its own standard | OAuth 2.0 |
| Common use | Enterprise web applications | Web and mobile applications |

Two more concepts are often mentioned alongside SSO: LDAP / Active Directory is the company's internal user directory, and SCIM is a synchronisation standard that automatically creates and removes user accounts in applications from the directory.

## Is there SSO in the Kurumsal.pro portal?

No. In the portal that Kurumsal.pro offers agencies for their corporate clients there is no SSO sign-in; there is no redirect to the company's identity provider through SAML or OIDC. Likewise, an LDAP / Active Directory connection and directory sync with SCIM are not offered. This should be stated clearly to the corporate client in the sales conversation and before setup.

Sign-in to the portal today works in these ways:

- **Email and password:** A work email and a password that meets the company's password rule (at least 10 characters, mixed upper and lower case and a digit).
- **Two-factor authentication:** A 6-digit code generated by an authenticator app; it can be made mandatory by role. Details are in the [two-factor authentication](/en/glossary/two-factor-authentication/) entry.
- **Passkey:** Passwordless sign-in with the device lock (fingerprint, face recognition).

The session closes after an idle timeout (15, 30 or 60 minutes) and an absolute time limit. The portal's security structure is described on the [security](/en/security/) page.

## How are accounts managed without SSO?

Accounts are managed with the portal's own tools. There is no self-registration in the portal; accounts are created by the company or the agency. The company administrator invites employees by work email (the email must belong to one of the company's permitted domains) or uploads up to 5,000 rows at once from Excel. When an employee leaves, the administrator disables the account; unlocking, resending an invitation and resetting 2FA are on the same screen. Details are on the [company admin panel](/en/company-admin-panel/) page.

Importing employee data from HR systems is also done by Excel upload rather than through a ready-made integration; the general framework is covered in the article on [HR software and the travel module](/en/blog/travel-module-integrated-with-human-resources-software-hrm-new-era-in-personnel-management/).

## Frequently asked questions
### What does SSO mean?
SSO stands for Single Sign-On. The user signs in once to the company's identity system and, with that session, reaches many applications without entering a separate password.

### Can I sign in to the Kurumsal.pro portal with SSO?
No. The Kurumsal.pro portal does not offer SSO sign-in; there is no redirect to the company's identity provider via SAML or OIDC. Sign-in uses email and password, two-factor authentication with an authenticator app, and a passkey.

### Without SSO, how are employee accounts created?
Accounts are created by the company or the agency; there is no self-registration in the portal. The company administrator invites employees by email, or uses an Excel bulk upload of up to 5,000 rows. Invited employees set their password from the link.

### What is the difference between SSO and two-factor authentication?
SSO determines where sign-in happens: the company's identity provider verifies the identity. Two-factor authentication adds a second proof to sign-in. The Kurumsal.pro portal has no SSO but has two-factor authentication, which can be made mandatory by role.

### How is access closed for an employee who leaves?
Because there is no SSO, access is closed in the portal itself. The company administrator disables the account from the account actions on the employee's record and can reopen it later if needed.